Motivation. The threat of gradient inversion attack has prompted prior work to employ defense mechanisms to mitigate this privacy risk in FL [1]}, [2]}. Intuitively, such defenses reduce the amount of information contained in the gradient about the training sample by either perturbing the gradient with noise [3]} or compressing them [4]}, [5]}, making recovery much more difficult. However, doing so also reduces the amount of information a sample can provide for training the global model, and hence has a negative impact on the model's performance. This is certainly true for principled defenses based on differential privacy [6]} such as gradient perturbation [3]}, however, defenses based on gradient compression seemingly provide a much better privacy-utility trade-off, effectively preventing the attack with minor reduction in model performance [1]}.
